 
   WebService
   (request-handlers [this]
-    {::authorize
+    {::authorization-endpoint
      (-> (fn [req]
            ;; TODO Establish whether the user-agent is already authenticated.
            ;; If not, create a session with client-id, scope and state and redirect to the login form

                          callback-uri code (:state session))}}))))
      wrap-params)

     ::exchange-code-for-access-token
     ;; This is initiated by the client
     (-> (fn [req]
           (let [params (:form-params req)
                 code (get params "code")
                 client-id (get params "client_id")
                 client-secret (get params "client_secret")
                 client (lookup-client+ (:client-registry this) client-id)]

             (if (not= (:client-secret client) client-secret)
               {:status 400 :body "Invalid request - bad secret"}

               (if-let [{identity :cylon/identity
                         granted-scopes :granted-scopes}

         wrap-params )})

  (routes [this]
    ["/" {"authorize" {:get ::authorization-endpoint}
          "permit-client" {:post ::permit}
          ;; TODO: Can we use a hyphen instead here?
          "access_token" {:post ::token-endpoint}}])

  (uri-context [this] "/login/oauth")

  AccessTokenAuthorizer
  (authorized? [component access-token scope]
    (if-not (contains? (set (keys scopes)) scope)
      (throw (ex-info "Scope is not a known scope to this authorization server"
                      {:component component
                       :scope scope
                       :scopes scopes}))
      (contains? (:scopes (get-session (:access-token-store component) access-token))
                 scope)))

  RequestAuthorizer
